2024 CVEs (page 93)
Page 93 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11342 | Medium | 6.1 | 2024-11-26 | The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or inco… |
CVE-2024-49597 | High | 7.6 | 2024-11-26 | Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged a… |
CVE-2024-49596 | Medium | 5.9 | 2024-11-26 | Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could poten… |
CVE-2024-49595 | High | 7.6 | 2024-11-26 | Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remot… |
CVE-2024-11678 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-11677 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend… |
CVE-2024-10729 | High | 8.8 | 2024-11-26 | The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-52899 | High | 8.5 | 2024-11-26 | IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server. |
CVE-2024-11676 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-11675 | Low | 3.5 | 2024-11-26 | A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-53843 | High | 8.1 | 2024-11-26 | @dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Ref… |
CVE-2024-11674 | Medium | 6.3 | 2024-11-26 | A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/… |
CVE-2024-11673 | Medium | 4.3 | 2024-11-25 | A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processi… |
CVE-2024-53597 | Medium | 6.3 | 2024-11-25 | masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit. |
CVE-2024-53554 | High | 8.0 | 2024-11-25 | A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by… |
CVE-2024-53101 | Medium | 5.5 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->i… |
CVE-2024-53100 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp… |
CVE-2024-53099 | High | 7.1 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link->type in bpf_link_show_fdinfo() If a newly-added link type do… |
CVE-2024-53098 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/ufence: Prefetch ufence addr to catch bogus address access_ok() only checks for ad… |
CVE-2024-53097 | Medium | 5.5 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in __do_krealloc This patch addresses an issue introduc… |
CVE-2024-53096 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somew… |
CVE-2024-53556 | Medium | 6.1 | 2024-11-25 | An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the log… |
CVE-2024-50672 | Critical | 9.8 | 2024-11-25 | A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passw… |
CVE-2024-50671 | Medium | 4.3 | 2024-11-25 | Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get… |
CVE-2024-53268 | High | 7.2 | 2024-11-25 | Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are… |
CVE-2024-53262 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholde… |
CVE-2024-53261 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, w… |
CVE-2024-53258 | Medium | 5.3 | 2024-11-25 | Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignm… |
CVE-2024-53599 | Medium | 5.4 | 2024-11-25 | A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-53255 | Medium | 5.4 | 2024-11-25 | BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a… |
CVE-2024-52811 | High | 8.2 | 2024-11-25 | The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a… |
CVE-2024-52529 | Medium | 5.8 | 2024-11-25 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that… |
CVE-2024-51723 | Medium | 4.6 | 2024-11-25 | A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to potentially execute act… |
CVE-2024-32468 | Medium | 5.4 | 2024-11-25 | Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Sel… |
CVE-2024-8272 | High | 7.8 | 2024-11-25 | The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process commu… |
CVE-2024-7915 | High | 7.8 | 2024-11-25 | The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. T… |
CVE-2024-52787 | Critical | 9.1 | 2024-11-25 | An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file. |
CVE-2024-45756 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 2… |
CVE-2024-45755 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22… |
CVE-2024-11672 | Medium | 4.3 | 2024-11-25 | Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciou… |
CVE-2024-11671 | Medium | 5.4 | 2024-11-25 | Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user t… |
CVE-2024-11670 | Medium | 5.4 | 2024-11-25 | Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authen… |
CVE-2024-27134 | High | 7.0 | 2024-11-25 | Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain… |
CVE-2024-11498 | High | 7.5 | 2024-11-25 | There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is p… |
CVE-2024-11403 | Critical | 9.8 | 2024-11-25 | There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL enco… |
CVE-2024-11664 | High | 8.8 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file e… |
CVE-2024-11663 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search… |
CVE-2024-9666 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy heade… |
CVE-2024-11662 | Medium | 6.3 | 2024-11-25 | A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_var… |
CVE-2024-11661 | Medium | 4.3 | 2024-11-25 | A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2024-10492 | Low | 2.7 | 2024-11-25 | A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context… |
CVE-2024-10451 | Medium | 5.9 | 2024-11-25 | A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embe… |
CVE-2024-10270 | Medium | 6.5 | 2024-11-25 | A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (D… |
CVE-2024-6538 | Medium | 5.3 | 2024-11-25 | A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to que… |
CVE-2024-11660 | Low | 3.5 | 2024-11-25 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manip… |
CVE-2024-11659 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown fun… |
CVE-2024-7056 | Low | 3.5 | 2024-11-25 | The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform… |
CVE-2024-6393 | Medium | 4.8 | 2024-11-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high priv… |
CVE-2024-11658 | Medium | 4.7 | 2024-11-25 | A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an… |
CVE-2024-11657 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of… |
CVE-2024-10710 | Low | 3.5 | 2024-11-25 | The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10709 | Medium | 6.8 | 2024-11-25 | The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2024-11656 | Medium | 4.7 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unkno… |
CVE-2024-11655 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the… |
CVE-2024-11654 | Medium | 4.7 | 2024-11-25 | A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file… |
CVE-2024-11653 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown… |
CVE-2024-11483 | Medium | 5.0 | 2024-11-25 | A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAut… |
CVE-2024-53930 | Medium | 5.4 | 2024-11-25 | WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser. |
CVE-2024-11652 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is a… |
CVE-2024-11651 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-11650 | Medium | 6.5 | 2024-11-25 | A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The… |
CVE-2024-11649 | High | 7.3 | 2024-11-25 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11648 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11647 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-53916 | High | 7.5 | 2024-11-25 | In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check… |
CVE-2024-11646 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-11666 | Critical | 9.0 | 2024-11-24 | Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure cha… |
CVE-2024-11665 | High | 8.8 | 2024-11-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_echarge_firmware allows OS Command Inject… |
CVE-2024-53915 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53914 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53913 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53912 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53911 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53910 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53909 | Critical | 9.8 | 2024-11-24 | An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untr… |
CVE-2024-53901 | Medium | 5.5 | 2024-11-24 | The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() m… |
CVE-2024-53899 | High | 7.8 | 2024-11-24 | virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly wh… |
CVE-2024-11233 | Medium | 4.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead… |
CVE-2024-11236 | Critical | 9.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can… |
CVE-2024-11234 | Medium | 4.8 | 2024-11-24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI i… |
CVE-2024-35160 | Medium | 4.3 | 2024-11-23 | IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to… |
CVE-2024-11632 | High | 7.3 | 2024-11-23 | A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_… |
CVE-2024-11631 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /e… |
CVE-2024-11231 | Medium | 6.4 | 2024-11-23 | The 우커머스 네이버페이 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mnp_purchase shortcode in all versions up to, and including… |
CVE-2024-11229 | Medium | 6.4 | 2024-11-23 | The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's add_plus_friends and add_plus_talk shortcodes in all versions u… |
CVE-2024-11228 | Medium | 6.4 | 2024-11-23 | The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pafw_instant_payment shortcode in all versi… |
CVE-2024-11034 | High | 7.3 | 2024-11-23 | The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable… |
CVE-2024-11227 | Medium | 6.4 | 2024-11-23 | The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up… |
CVE-2024-11199 | Medium | 6.4 | 2024-11-23 | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rescue_progressbar shortcode in all versions up to, an… |
CVE-2024-10519 | Medium | 6.1 | 2024-11-23 | The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in… |